Start selling

Is my AI-built app secure? A 10-minute checklist

A practical checklist for apps built with Lovable, Cursor, Bolt, Replit or v0: database rules, keys, headers, files and logins.

Short answer: an app built with AI tools can be secure, but the tools don't guarantee it. Spend 10 minutes on the five checks below before you share your app or sell it.

Why AI-built apps need a check

AI coding tools write working code fast, and they also reproduce common mistakes. In 2025, CVE-2025-48757 described insufficient database row-level security in apps built with Lovable, rated 9.3 (critical), which could let unauthenticated visitors read or write database tables. Lovable disputes the CVE, saying each customer is responsible for protecting its own app data — which is exactly why builders should check. The fix is usually simple; the problem is that nobody looked.

The checklist

1. Database rules (2 minutes)

If your app uses Supabase, open the Table Editor and check every table that holds user data:

  • Row Level Security is enabled.
  • There is a policy that limits rows to their owner, for example auth.uid() = user_id.
  • No policy says true for everyone on tables with personal data.

2. Keys in your code (2 minutes)

Search your project for secret keys. The publishable or "anon" key is meant to be public; these are not:

  • sk_live_ or sk_test_ (Stripe secret keys)
  • service_role (Supabase admin key)
  • keys for OpenAI, Anthropic or other AI APIs

Secret keys belong in server-side environment variables, never in front-end code.

3. Files that should never be public (2 minutes)

Make sure your deployed site doesn't serve:

  • .env or .env.local
  • a .git folder
  • source maps (.map files) for production code, unless you chose to publish them

4. Security headers (2 minutes)

Run our free security header check. Aim for at least a B. The most useful headers are Content-Security-Policy, Strict-Transport-Security and X-Content-Type-Options.

5. Logins and limits (2 minutes)

  • Sign-up and password reset have rate limits.
  • Admin pages check the user's role on the server, not only in the interface.
  • API routes reject requests without a valid session.

What to do if something fails

Fix it yourself using the notes above, ask your AI tool to fix the specific issue, or hire a developer through the Fix-It Desk (terms). Then run the check again.

Selling your app?

Listings on GreenGo show a dated Green Light check, so buyers can see what was checked before they pay.

Questions & answers